Threat Intelligence Briefing

Global threat activity spiked from 175,130 to 3,303,221 events, a change by several orders of magnitude, driven primarily by aggregated threat traffic (2.9M events) and malware C2 infrastructure. This surge is not consistent with typical background noise and represents a significant deviation from the 7-day average. Nordic countries remain below global volume thresholds, with Sweden and Finland reporting moderate increases in brute-force and reconnaissance activity, but no anomalous patterns. The majority of high-volume IPs originate from known malicious ranges in Romania, Bulgaria, and Indonesia, many tied to long-standing botnet operations rather than new campaigns. Consider temporary blocking or rate-limiting traffic from ASNs associated with Unmanaged Ltd and TechOff Srv Limited, which show high report-to-IP ratios indicative of abuse-enabling infrastructure. Deprioritize isolated residential IP reports, as they align with routine background noise. Focus detection logic on SSH and web-based brute-force patterns across /24 ranges linked to 195.178.110.0/24 (Bulgaria) and 185.242.3.0/24 (Netherlands), where known attacker infrastructure persists.